Check Point Firewall-1 Script Tag Checking Bypass Vulnerability

Bugtraq ID:	954
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 29 2000 12:00AM
Updated:	Jan 29 2000 12:00AM
Credit:	Discovered and posted to Bugtraq by Arne Vidstrom <[email protected]>.
Vulnerable:	Check Point Software Firewall-1 3.0
Not Vulnerable:	Check Point Software Firewall-1 4.0

Check Point Firewall-1 Script Tag Checking Bypass Vulnerability

Firewall-1 includes the ability to alter script tags in HTML pages before passing them to the client's browser. This alteration invalidates the tag, rendering the script unexecutable by the browser. In version 3, this function can be bypassed by adding an extra opening angle bracket. The tag will be left unmodified, and the browser will be able to execute the contained script. Hostile script could lead to a remote compromise of the client system.

Firewall-1 version 4 will alter the tag as expected.

Check Point Firewall-1 Script Tag Checking Bypass Vulnerability

This exploit is a web page that will merely cause an alert window to appear. The code is:

<<script language="JavaScript">
alert("<<script> tag succesfully passed!")
</script>

• /data/vulnerabilities/exploits/fw1test.html

Check Point Firewall-1 Script Tag Checking Bypass Vulnerability

Solution:
Upgrade to Check Point FireWall-1 version 4.1 Service Pack 2 or later.

Check Point Firewall-1 Script Tag Checking Bypass Vulnerability

References: